Which teams should own cyber-physical convergence risk?

How should convergence risk be owned?

Ownership should follow the full access path, not the organisational silo. Cyber-physical convergence risk is easiest to manage when security, identity, physical security and operational teams share decision rights, because the failure usually sits between controls, not inside one control alone.

A converged ownership model should define who can approve access, who can revoke it, who can investigate exceptions, and who is accountable when a badge, device, account or operator action crosses a boundary. That is what turns fragmented controls into governable risk ownership.

Why siloed ownership leaves the real risk unresolved

When teams only own their own layer, they tend to optimise for local control health rather than end-to-end exposure. A system can look “secure” in identity, “secure” in physical access and still be unsafe if the combined path lets one compromise unlock the other.

The practical failure mode is blind spots at handoff points. Security may see the digital permissions, physical security may see the site entry model, and operations may see uptime and change windows, but no team alone sees how a weak exception, shared credential, visitor process or privileged maintenance path can connect them.

Convergence ownership also matters for governance. If nobody has authority to reconcile conflicting decisions, exceptions accumulate and risk acceptance becomes implicit rather than deliberate.

What a workable shared governance model looks like

The best operating model is usually a small cross-functional governance group with clear escalation paths, not a broad committee with vague accountability. The group should set the minimum control standard for access paths, decide which exceptions require joint approval, and maintain a single view of materially sensitive integrations.

Security should usually own the control framework, identity should own authentication and access lifecycle mechanics, physical security should own site and facility enforcement, and operational owners should own business-critical workflow impact and exception tolerance. Shared governance does not mean shared ambiguity; it means each team owns its part while one model governs the whole.

Where cyber-physical systems are critical, the governance model should also define evidence requirements. Teams should be able to show who approved access, how it was granted, how it is reviewed, and what happens when a human process or machine process needs temporary elevated access.

Risk and Threat Considerations

Cyber-physical convergence risk grows when separate teams can each make a locally reasonable decision that becomes unsafe in combination. The danger is not just unauthorised access, but also slow drift, where exceptions, shared credentials, and ad hoc overrides create a path that no single owner feels responsible for closing.

Failure mechanism: fragmented ownership breaks end-to-end visibility, so weak digital access, weak physical access, or poor exception handling can combine into a single compromise path that bypasses the intended control boundary.

Impact: a compromise can cross from one environment into another, expand blast radius, and delay containment because each team sees only part of the incident and assumes another team owns the response.

Practitioner Guidance

What to prioritise: define a single decision model for the highest-risk access paths first, especially where physical entry, privileged systems and operational continuity intersect. That is where ownership gaps are most likely to produce real exposure.

What to verify: confirm there is named accountability for approval, revocation, exception handling and incident response across the full path. If any step is “everyone’s job,” it is effectively nobody’s job.

Common mistake: treating convergence as a coordination problem only. Coordination helps, but without explicit decision rights and escalation, teams will still defer action when a risk spans their boundary.

Practitioner takeaway: the right owner is the function that can force end-to-end closure, not the function that owns the most controls.

Related resources from NHI Mgmt Group

• How should teams reduce the risk from overprivileged NHIs?
• What do security teams get wrong about cyber-physical convergence?
• Why does cyber-physical convergence increase identity governance risk?
• Who should own critical infrastructure risk management when cyber, physical, supply chain, and personnel risks all overlap?